CVE-2026-17608

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

CVE-2026-17608 WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

EUVD-2026-59924

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

CVE-2026-17608: Cross-Site Request Forgery (CSRF)

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

PT-2026-73134

Name of the Vulnerable Software and Affected Versions WP Compress – Instant Performance & Speed Optimization versions prior to 7.10.10 Description This issue is a Cross-Site Request Forgery CSRF, which occurs when a malicious actor tricks a user into performing an action they did not intend to do...

CVE-2026-73033: Improper Limitation of a Pathname to a Restricted Directory

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

ROS-20260804-73-0026

The vulnerability of the gfs2dinodein function in the fs/gfs2/dir.c file of the GFS2 file system in the Linux operating system is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2025-64719

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface...

SUSE CVE-2026-5740

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users v...

BIT-ELASTICSEARCH-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

PT-2026-65544

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

GHSA-26GQ-P25F-99CP frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...

EUVD-2026-46582

Vulnerability in the Oracle Payments product of Oracle E-Business Suite component: File Transmission. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payments. Successful...

CVE-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

PT-2026-63006

Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: UK Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. Successful attacks of...

PT-2026-63262

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion in the query evaluation component allows a low-privileged authenticated user with read-level index access to cause a denial of service. By submitting a specially...

PT-2026-62244

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description An issue in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead to unauthorized access to...

PT-2026-63133

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Item Catalog. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful...

D-Link DNS-320 DoS

The vulnerability of the URL processor in the web interface of the D-Link DNS-320 network storage microprogramming system is related to errors in access control when processing the File parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions...

GHSA-CXPQ-8V7Q-CG56 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset optional field; check is post-decompression anyway - No operator...